- Full title: Decree on administrative penalties for violations in the fields of cybersecurity and personal data protection
- Issued by: the Government, 19 August 2026
- In force from: 19 August 2026 (the date of issue)
- Structure: 4 chapters, 82 articles
- Official Vietnamese text: Government e-portal (DocID 219266) · Signed PDF
- Third-party English translation: LuatVietnam (may need a subscription)
Note: this page summarises the main penalties for businesses. It is not the full text of the 82 articles. Fines below are for organisations unless stated otherwise.
The March 2026 draft of this decree is archived for comparison only; current obligations and fines are those of this adopted decree.
Legal basis and structure
The Decree implements the Law on Handling Administrative Violations, Cybersecurity Law No. 116/2025/QH15 and Personal Data Protection Law No. 91/2025/QH15, together with related laws on digital transformation, electronic transactions, e-commerce and the digital technology industry.
- Chapter I (Articles 1–8): general provisions: scope, the limitation period, types of penalty, maximum fines and penalties in the electronic environment.
- Chapter II (Articles 9–71): violations, penalties and remedial measures:
- Sections 1–5 (Articles 9–38): cybersecurity;
- Section 6 (Articles 39–71): personal data protection: consent, data subject rights, transfers, trading in data, breaches, DPIA, cross-border transfers, DPOs, employment and cameras.
- Chapter III (Articles 72–79): who can record violations and impose penalties.
- Chapter IV (Articles 80–82): entry into force and transitional provisions.
Fines and sanctioning powers (Article 7)
- Who the stated fine applies to:
- Cybersecurity (Sections 1–5): the fine is for an individual. An organisation pays twice that amount.
- Personal data protection (Section 6): the fine is for an organisation. An individual pays half.
- Caps for organisations:
- General cybersecurity violations: VND 200 million (VND 100 million for individuals).
- Personal data protection violations: VND 3 billion (VND 1.5 billion for individuals).
- Unlawful buying and selling of personal data: up to 10 times the proceeds. If there are no proceeds, or the result is below VND 3 billion, the cap is VND 3 billion.
- Cross-border transfer violations by organisations: up to 5% of the preceding year’s revenue. If there is no revenue, or the result is below VND 3 billion, the cap is VND 3 billion. The revenue-based brackets are in Clause 3 of Article 56; the fixed amounts that apply instead (no revenue in Vietnam, or a result below VND 3 billion) are in Clause 4.
- Sanctioning powers: the powers of the officials in Chapter III are stated for one violation by an organisation. For fines on individuals, their power is half that amount (Clause 2).
Article 8. Penalties in the electronic environment
Electronic evidence (data messages, images, audio, digital documents collected directly or online) can be used to handle violations. Violation records can be drawn up, digitally signed, sent and kept electronically.
Key personal data protection penalties (Section 6)
Article 43. Consent
| Violation | Fine | Additional and remedial measures |
|---|---|---|
| Processing without valid consent; refusing service unless the data subject consents to other purposes; being unable to prove consent; not giving notice when processing sensitive data | VND 30–50 million | For processing without consent (Point a, Clause 1): confiscation of the means used and irreversible deletion of the data |
| Pre-ticked consent; blurring the choice between consenting and refusing | VND 30–50 million | Confiscation; deletion of the unlawfully collected data |
| Intentionally continuing to process after the data subject, or a state agency in writing, asked for processing to stop or be restricted | VND 50–70 million | Confiscation; surrender of unlawful proceeds; deletion |
| Treating silence or no response as consent | VND 50–70 million | Confiscation; surrender of unlawful proceeds; deletion |
See what is consent.
Article 44. Data subject request procedures
| Violation | Fine | Statutory deadline |
|---|---|---|
| No procedure or forms, unclear responsibilities, or no or incomplete reply about the procedure | VND 10–20 million | Reply within 2 working days of a valid request |
| Processor or third party misses the controller’s deadline for acting on a request (stop processing, delete, correct) | VND 20–30 million | As set by the controller |
| Controller misses the deadline to let the data subject view, correct or obtain data | VND 30–40 million | 10 days (extendable by up to 10) |
| Controller misses the deadline for withdrawal of consent, restriction or objection | VND 30–40 million | 15 days (extendable by up to 15) |
| Controller misses the deadline for deletion | VND 30–40 million | 20 days (extendable by up to 20) |
Article 52. Transfers of personal data
- VND 20–30 million: a transfer agreement that does not set out data protection responsibilities, data subject rights and cooperation if something goes wrong; internal sharing between departments without a control procedure or safeguards against leaks to third parties.
- VND 30–50 million: a paid transfer under Point a or d, Clause 1, Article 17 of the Law without defining who is controller, processor or third party; not limiting the data to the purpose; no retention period, or not deleting the data once the purpose is fulfilled.
- VND 50–80 million: transferring sensitive data without physical security for storage and transmission devices, encryption, anonymisation or other security measures.
Article 53. Unlawful buying and selling of personal data
- Main fine: 2 to 10 times the proceeds for buying, selling or exchanging personal data for unlawful gain; paid transfers without an agreement or for another purpose; trading data on a data exchange without de-identifying it.
- Where there are no proceeds (Clause 3). Under Clause 2, if there are no proceeds and 10 times the proceeds would be below VND 3 billion, the fine can go up to VND 3 billion:
- fewer than 1,000 data subjects (basic data) or 200 (sensitive data): VND 70–100 million;
- 1,000 to under 2,000 (basic) or 200 to under 400 (sensitive): VND 100–300 million;
- 2,000 to under 10,000 (basic) or 400 to 2,000 (sensitive): VND 300–500 million;
- 10,000 or more (basic) or 2,000 or more (sensitive): VND 500 million–1 billion;
- harm to national defence, security, public order, foreign relations, the macro-economy, the life, health, honour, dignity or property of data subjects, or the lawful rights and interests of organisations and individuals: VND 1–3 billion.
- Additional and remedial measures: confiscation, surrender of all unlawful proceeds, permanent deletion of the data, and notifying every affected data subject.
Article 54. Breach notification and response
| Violation | Fine | Provision |
|---|---|---|
| Processor does not promptly tell the controller about a breach; controller does not record the breach in writing; breach report deliberately hides or misstates its scale or the types of data | VND 10–20 million | Clause 1 |
| Not notifying the A05 Department of a violation, misuse of data or infringement of data subject rights | VND 20–40 million | Clause 2 |
| Notifying the A05 Department more than 72 hours after detecting a breach that harms or may harm security, order, or data subjects’ life, health, honour or property | VND 40–60 million | Clause 3 |
| Not taking measures to stop the breach or remedy its consequences; not cooperating with the authority | VND 60–80 million | Clause 4 |
Fixing a breach technically does not replace the legal duty to notify within 72 hours where notification is required. See the 72-hour rule.
Article 55. Data processing impact assessment (DPIA)
- VND 20–30 million (Clause 1): starting to process without preparing a DPIA dossier or keeping it at the head office; not sending an original to the A05 Department within 60 days of first processing; deliberately not completing the dossier when asked; not updating it every 6 months when things change, or within 10 days when an immediate update is required.
- VND 50–100 million (Clause 2): falsifying data or giving false information in the dossier, or refusing to correct it when the A05 Department asks in writing.
- Key remedial measure (Point b, Clause 3): for processing without a DPIA dossier (Point a, Clause 1), the organisation must stop processing personal data until it has filed the dossier and the authority has confirmed it. This can halt the whole business.
See what is a DPIA.
Article 56. Cross-border transfers
- Dossier violations (Clause 1): VND 30–50 million. No cross-border transfer dossier; original not filed within 60 days; dossier not updated; contact details of the recipient’s DPO not provided; onward transfers by the recipient to third parties not controlled.
- Agreement and security violations (Clause 2): VND 50–100 million. No binding transfer contract; no consent to the transfer abroad; no suitable security measures; obstructing inspection; continuing to transfer after an order to stop.
- Revenue-based fines (Clause 3) apply where an organisation transfers data abroad without a dossier, hides or misstates data flows, and this leads to the leak or loss of Vietnamese citizens’ personal data, or where it keeps transferring after an order to stop. The fine is a share of total revenue in the Vietnamese market in the preceding financial year:
- 1–2%: 10,000 to under 100,000 data subjects affected;
- 2–3%: 100,000 to under 1,000,000 data subjects;
- 3–5%: 1,000,000 or more data subjects, or transfers after an order to stop that harm national defence or security.
- Fixed alternatives (Clause 4) apply if the organisation has no revenue in Vietnam, or the revenue-based fine would be under VND 3 billion:
- 10,000 to under 100,000 data subjects: VND 200–500 million;
- 100,000 to under 1,000,000: VND 500 million–1 billion;
- 1,000,000 or more, or transfers after an order to stop that harm security: VND 1–3 billion.
- Additional and remedial measures: suspension of cross-border transfers for 6 to 12 months (Point b, Clause 5); an order to stop transferring until the dossier is complete and confirmed (Point b, Clause 6); and requiring the recipient to delete all unlawfully transferred data.
See cross-border data transfer.
Article 57. Designating an internal data protection department or staff (DPO)
- Warning or VND 10–20 million: no confidentiality agreement with the DPO; no training; a designation decision that does not set out functions, duties and powers.
- VND 20–30 million: designating someone without at least a college degree or 2 years of experience in a relevant field (legal, IT, cybersecurity, compliance, risk management, HR); designating someone untrained in data protection; no formal designation decision.
- Remedial measure: replace the person with someone qualified and give the authority proof.
Article 58. Data protection service providers (outsourced DPO)
- Individual providers: VND 10–30 million for lacking a college degree or 3 years of relevant experience, acting beyond the contract, or not deleting client data after the contract ends.
- Organisation providers: VND 30–50 million for no complete capability profile, fewer than 3 qualified staff, no service contract and data processing agreement with the client, or not publishing the provider’s details.
- Serious violations: VND 50–100 million for using the service to access, collect or process client data unlawfully, plus confiscation. Suspension of the service for 6 to 12 months applies to this and to the missing profile or too few qualified staff (Points a and b, Clause 2).
See what is a DPO.
Article 61. Recruitment and employment
Fines range from VND 20 million to 100 million in three bands:
- VND 20–50 million (Clause 1): asking candidates for data not needed for recruitment; using it for other purposes without agreement; processing it without consent or beyond the consent given; not deleting it when the candidate is not hired (unless otherwise agreed).
- VND 50–70 million (Clause 2): keeping employee data longer than the law or agreement allows; not deleting it when employment ends (unless otherwise agreed or required); using technology to collect data without employees being clearly informed, including monitoring software or workplace cameras without notice; using technical measures that do not comply with the law.
- VND 70–100 million (Clause 3): processing or using employee data collected by unlawful technical measures.
Article 71. Cameras and audio or video recording
- VND 10–20 million (Clause 1): installing or using recording equipment in public spaces or customer service areas without clearly visible physical or electronic notices; not giving the controller’s contact details when a data subject asks for their images.
- VND 30–50 million (Clause 2): using images or voices from public surveillance cameras for commercial purposes, behavioural analysis or automated facial recognition to build personal profiles without valid consent; unlawfully extracting, sharing or publishing recordings (except when provided on the written request of a competent authority).
- Additional and remedial measures: confiscation for Clause 2 violations; irreversible deletion of unlawfully collected data; setting up and publishing the controller’s contact details.
See CCTV and camera surveillance.
Who can impose penalties (Articles 72–79)
- Director of the A05 Department (Department of Cybersecurity and High-Tech Crime Prevention, Ministry of Public Security): fines up to the maximum for personal data protection violations and up to VND 200 million for cybersecurity; can withdraw licences, suspend activities and order remedial measures (Clause 6, Article 72).
- Directors of provincial police departments: fines up to the maximum for personal data protection and up to VND 200 million for cybersecurity (Clause 5, Article 72).
- Heads of the provincial cybersecurity and high-tech crime divisions: up to 80% of the maximum for personal data protection and up to VND 160 million for cybersecurity (Clause 3, Article 72).
- Chairpersons of People’s Committees and inspectors: within their functions and powers (Articles 73 and 74).
- Recording violations (Article 79): anyone with sanctioning powers under Articles 72–77, inspectors, and officials of the army, police and state agencies under Article 77 on duty in cybersecurity or personal data protection.
Entry into force and transition (Articles 80–81)
- In force (Article 80): from 19 August 2026.
- Transition (Article 81): violations committed before that date but detected or handled later are dealt with under the rules in force when they were committed. If this Decree does not penalise the act, or penalises it less severely, this Decree applies.
Sources
- Decree 330/2026/ND-CP — Government e-portal (official Vietnamese text)
- Decree 330/2026/ND-CP — signed PDF (Vietnamese)
- Decree 330/2026/ND-CP — English translation by LuatVietnam (third party)
For a practical guide to these fines, see data protection fines in Vietnam.
